Skip to content

aad oauth2grant set

Update OAuth2 permissions for the service principal


aad oauth2grant set [options]


Option Description
--help output usage information
-i, --grantId <grantId> objectId of OAuth2 permission grant to update
-s, --scope <scope> Permissions to grant
--query [query] JMESPath query string. See for more information and examples
-o, --output [output] Output type. json,text. Default text
--pretty Prettifies json output
--verbose Runs command with verbose logging
--debug Runs command with debug logging


Before you can update service principal's OAuth2 permissions, you need to get the objectId of the permissions grant to update. You can retrieve it using the aad oauth2grant list command.

If the objectId listed when using the aad oauth2grant list command has a minus sign ('-') prefix, you may receive an error indicating --grantId is missing. To resolve this issue simply escape the leading '-'.

aad oauth2grant set --grantId \\-Zc1JRY8REeLxmXz5KtixAYU3Q6noCBPlhwGiX7pxmU


Update the existing OAuth2 permission grant with ID YgA60KYa4UOPSdc-lpxYEnQkr8KVLDpCsOXkiV8i-ek to the Calendars.Read Mail.Read permissions

aad oauth2grant set --grantId YgA60KYa4UOPSdc-lpxYEnQkr8KVLDpCsOXkiV8i-ek --scope "Calendars.Read Mail.Read"

More information